AMBIENT CALCULUS-BASED MODAL LOGIC MODEL CHECKING 



RELATED APPLICATIONS 

This application is related to the cofiled, copending and coassigned application 
entitled "Ambient Calculus-Based Modal Logics for Mobile Ambients" [docket no. 
1018.021US1]. 

FIELD OF THE INVENTION 

This invention relates generally to ambient calculus-based modal logics, and more 
specifically to model checking for such ambient calculus-based modal logics. 

BACKGROUND OF THE INVENTION 

Computing has become increasingly interconnected. Whereas before computers 
were discrete, unconnected units, because of the Internet as well as other networks, they 
are increasingly fluid, interconnected units. A computer program, which may be made up 
of one or more executable processes, or threads, may be mobile. For example, a thread of 
the program may move from computer to computer over the Intemet. It may be executed 
in a distributed fashion over many computers, or a different instance of the thread may be 
run on each of many computers. 

The movement of threads from computer to computer, or even to different parts 
within the same computer, poses new security and other risks for which there is no formal 
analysis mechanism. For example, a thread may be unstable, such that having it be run 
on a particular computer may cause the computer to crash. More so, the thread may be 
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malicious, such as part of a virus program, such that its purpose is to compromise the 
computers it moves to. 

More specifically, there are two distinct areas of work in mobility: mobile 
computing, concerning computation that is carried out in mobile devices (laptops, 
personal digital assistants, etc.), and mobile computation, concerning mobile code that 
moves between devices (agents, etc.). Mobility requires more than the traditional notion 
of authorization to run or to access information in certain domains: it involves the 
authorization to enter or exit certain domains. In particular, as far as mobile computation 
is concerned, it is not realistic to imagine that an agent can migrate from any point A to 
any point B on the Internet. Rather an agent must first exit its administrative domain 
(obtaining permission to do so), enter someone else's administrative domain (again, 
obtaining permission to do so) and then enter a protected area of some machine where it 
is allowed to run (after obtaining permission to do so). 

Access to inforaiation is controlled at many levels, thus multiple levels of 
authorization may be involved. Among these levels we have: local computer, local area 
network, regional area network, wide-area intranet and intemet. Mobile programs should 
be equipped to navigate this hierarchy of administrative domain, at every step obtaining 
authorization to move fiirther. Laptops should be authorized to access resources 
depending on their location in the administrative hierarchy. 

In general, a process or thread resides within a container referred to as an ambient. 
The ambient includes one or more processes or threads, as well as any data, etc., that 
move with the processes or threads. An ambient that can move is referred to as a mobile 
ambient. The ambient can be any type of container: a software container such as a 



particular part of an operating system, for example, as well as a hardware container, such 
as a particular computer or peripheral device. 

More specifically, an ambient has the following main characteristics. First, an 
ambient is a bounded placed where computation happens. The interesting property here is 
the existence of a boimdary aroxmd an ambient. Examples of ambients include: a web 
page (boxmded by a file), a virtual address space (boimded by an addressing range), a 
Unix file system (boimded within a physical volimie), a single data object (boimded by 
"self*) and a laptop (bounded by its case and data ports). Non-examples are: threads (the 
boundary of what is "reachable" is difficult to determine) and logically related collections 
of objects. 

Second, an ambient is something that can be nested within other ambients. For 
example, to move a running application fi-om work to home, the application must be 
removed firom an enclosing (work) ambient and inserted in a different enclosing (home) 
ambient. A laptop may need a removal pass to leave a workplace, and a government pass 
to leave or enter a country. 

Third, an ambient is something that can be moved as a whole. If a laptop is 
connected to a different network, all the address spaces and file systems within it move 
accordingly and automatically. If an agent is moved fi-om one computer to another, its 
local data should move accordingly and automatically. 

As mentioned, there is no formal analysis mechanism within the prior art for such 
mobile ambients. This means that there is no manner by which to describe formally, for 
example, a security policy for a given computer system, which could be applied against a 
mobile ambient within a formal analysis mechanism to determine if the ambient poses a 



security or other risk to the system. In particular, most fomial analysis mechanisms, or 
frameworks, only provide for temporal distinction among processes and ambients, but 
assume that the processes and ambients are stationary - or otherwise do not provide for 
spatial distinction among them. Furthermore, there is no manner by which to formally 
verify that a policy or other model for process and ambients can be verified for 
correctness. 

For these and other reasons, there is a need for the present invention. 

SUMMARY OF THE INVENTION 

The invention relates to ambient calculus-based modal logic model checking. In 
one embodiment, a computer-implemented method receives a process, which is also 
referred to as a thread or agent in varying embodiments. The method analyzes the 
process against a fomiula using a predetermined modal logic based on ambient calculus. 
The formula, for example, can represent a model to be checked, a pohcy to be verified, 
such as a security policy, etc. The method finally outputs whether the process satisfies 
the formula or not. 

In one embodiment, analysis of the process against the formula is conducted in a 
recursive manner. The process is normaHzed to determine whether the process comprises 
only a single element. The process is partitioned to determine whether each component 
of the process satisfies the formula. A plurality of names of the process is determined, 
and it is verified that a name exists for the formula that is unequal to any of this plurality 
of names. Each sublocation of the process is analyzed against the formula. The spatial 
' reach of the process is also analyzed against the formula. 



Embodiments of the invention provide for advantages over the prior art. A 
pohcy, such as a security or mobility pohcy, expressed in terms of a formula according to 
the modal logic can be verified in a formal manner. For example, the logic can be used to 
describe a policy as how an applet can move arovmd among different containers, or 
ambients. A process can then be matched, or analyzed, against this formal description of 
the policy. The pohcy can be intricate, stating, for example, how a process can run on a 
specific machine, in detail. 

Embodiments of the invention include computer-implemented methods, 
computer-readable media, and computerized systems of varying scope. Still other 
embodiments, advantages and aspects of the invention will become apparent by reading 
the following detailed description, and by reference to the drawings, 

BRIEF DESCRIPTION OF THE DRAWINGS 

FIG. 1 is a diagram of an operating environment in conjimction with which 
embodiments of the invention may be practiced; 

FIG. 2 is a diagram of an example environment of ambients and processes in 
conjunction with which embodiments of the invention may be practiced; 

FIG. 3 is a flowchart of a method according to an embodiment of the invention; 

and, 

FIGs. 4-5 are diagrams of example situations of mobile ambients utilized in 
conjunction with the modal logic of varying embodiments of the invention. 



DETAILED DESCRIPTION OF THE INVENTION 



Organization of the Detailed Description 

The detailed description is organized as follows. The first section, the 
introduction, provides guidelines as to how to interpret the other sections of the detailed 
description. The second section describes an operating environment in context with 
which embodiments of the invention can be practiced. The third section provides a 
description of a mobile computing envirormient, which also gives guidance as to the 
context in which embodiments of the invention can be practiced. The fourth section 
describes modal logics, in accordance with which embodiments of the invention can be 
practiced. This fourth section includes various sub-sections, each of which detail different 
aspects of such modal logics. The fifth section highlights some examples of processes 
and formulas in the context of such modal logics. 

The sixth section presents methods according to embodiments of the invention, 
which rely on the modal logics of the fourth section. The methods relate generally to 
analyzing processes against formulas in the context of the modal logics. Finally, a 
conclusion is given in the seventh section of the detailed description. 

Introduction 

In the following detailed description of exemplary embodiments of the invention, 
reference is made to the accompanying drawings which form a part hereof, and in which 
is shown by way of illustration specific exemplary embodiments in which the invention 
may be practiced. These embodiments are described in sufficient detail to enable those 



skilled in the art to practice the invention, and it is to be understood that other 
embodiments may be utilized and that logical, mechanical, electrical and other changes 
may be made without departing from the spirit or scope of the present invention. The 
following detailed description is, therefore, not to be taken in a limiting sense, and the 
scope of the present invention is defined only by the appended claims. 

Some portions of the detailed descriptions which follow are presented in terms of 
algorithms and symbolic representations of operations on data bits within a computer 
memory. These algorithmic descriptions and representations are the means used by those 
skilled in the data processing arts to most effectively convey the substance of their work 
to others skilled in the art. An algorithm is here, and generally, conceived to be a self- 
consistent sequence of steps leading to a desired result. The steps are those requiring 
physical manipulations of physical quantities. Usually, though not necessarily, these 
quantities take the form of electrical or magnetic signals capable of being stored, 
transferred, combined, compared, and otherwise manipulated. (It is noted that the terms 
document and text are used interchangeably herein and should be construed as 
interchangeable as well.) 

It has proven convenient at times, principally for reasons of conmion usage, to 
refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the 
like. It should be home in mind, however, that all of these and similar terms are to be 
associated with the appropriate physical quantities and are merely convenient labels 
applied to these quantities. Unless specifically stated otherwise as apparent from the 
following discussions, it is appreciated that throughout the present invention, discussions 
utilizing terms such as processing or computing or calculating or determining or 



displaying or the like, refer to the action and processes of a computer system, or similar 
electronic computing device, that manipulates and transforms data represented as 
physical (electronic) quantities within the computer system's registers and memories into 
other data similarly represented as physical quantities within the computer system 
memories or registers or other such information storage, transmission or display devices. 

Operating Environment 

Referring to FIG. 1, a diagram of the hardware and operating environment in 
conjimction with which embodiments of the invention may be practiced is shown. The 
description of FIG. 1 is intended to provide a brief, general description of suitable 
computer hardware and a suitable computing environment in conj miction with which the 
invention may be implemented. Although not required, the invention is described in the 
general context of computer-executable instructions, such as program modules, being 
executed by a computer, such as a personal computer. Generally, program modules 
include routines, programs, objects, components,.data structures, etc., that perform 
particular tasks or implement particular abstract data types. 

Moreover, those skilled in the art will appreciate that the invention may be 
practiced with other computer system configurations, including hand-held devices, 
multiprocessor systems, microprocessor-based or progranmiable consxmier electronics, 
network PC's, minicomputers, mainframe computers, and the like. The invention may 
also be practiced in distributed computing environments where tasks are performed by 
remote processing devices that are linked through a communications network. In a 
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distributed computing environment, program modules may be located in both local and 
remote memory storage devices. 

The exemplary hardware and operating environment of FIG. 1 for implementing 
the invention includes a general purpose computing device in the form of a computer 20, 
including a processing unit 21, a system memory 22, and a system bus 23 that operatively 
couples various system components include the system memory to the processing unit 21. 
There may be only one or there may be more than one processing unit 21 , such that the 
processor of computer 20 comprises a single central-processing unit (CPU), or a plurality 
of processing units, commonly referred to as a parallel processing environment. The 
computer 20 may be a conventional computer, a distributed computer, or any other type 
of computer; the invention is not so limited. 

The system bus 23 may be any of several types of bus structures including a 
memory bus or memory controller, a peripheral bus, and a local bus using any of a 
variety of bus architectures. The system memory may also be referred to as simply the 
memory, and includes read only memory (ROM) 24 and random access memory (RAM) 
25. A basic input/output system (BIOS) 26, containing the basic routines that help to 
transfer information between elements within the computer 20, such as during start-up, is 
stored in ROM 24. The computer 20 further includes a hard disk drive 27 for reading 
from and writing to a hard disk, not shown, a magnetic disk drive 28 for reading from or 
writing to a removable magnetic disk 29, and an optical disk drive 30 for reading from or 
writing to a removable optical disk 31 such as a CD ROM or other optical media. 

The hard disk drive 27, magnetic disk drive 28, and optical disk drive 30 are 
connected to the system bus 23 by a hard disk drive interface 32, a magnetic disk drive 



interface 33, and an optical disk drive interface 34, respectively. The drives and their 
associated computer-readable media provide nonvolatile storage of computer-readable 
instructions, data structures, program modules and other data for the computer 20. It 
should be appreciated by those skilled in the art that any type of computer-readable media 
5 which can store data that is accessible by a computer, such as magnetic cassettes, flash 
memory cards, digital video disks, Bernoulli cartridges, random access memories 
(RAMs), read only memories (ROMs), and the like, may be used in the exemplary 
operating environment. 



10 optical disk 31, ROM 24, or RAM 25, including an operating system 35, one or more 
application programs 36, other program modules 37, and program data 38. A user may 
enter commands and information into the personal computer 20 through input devices 
such as a keyboard 40 and pointing device 42. Other input devices (not shown) may 
include a microphone, joystick, game pad, satellite dish, scaimer, or the like. These and 

15 other input devices are often connected to the processing unit 21 through a serial port 
interface 46 that is coupled to the system bus, but may be connected by other interfaces, 
such as a parallel port, game port, or a universal serial bus (USB). A monitor 47 or other 
type of display device is also connected to the system bus 23 via an interface, such as a 
video adapter 48. In addition to the monitor, computers typically include other peripheral 

20 output devices (not shown), such as speakers and printers. 



A number of program modules may be stored on the hard disk, magnetic disk 29, 




The computer 20 may operate in a networked environment using logical 
connections to^nTormofer^^ such as remote computer 49. Th 
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OTiputer 20; the invention is not limited to a particular type of communications device. 
The rCTaote computer 49 may be another computer, a server, a router, a network PC, a 
client, a peer ofevke or other common network node, and typically includes many or all 
of the elements described-above relative to the computer 20, although only a memory 
storage device 50 has been illustrated 1. The logical connections depicted in FIG. 

^ 1 include a local-area network (LAN) 51 and a^de-area network (WAN) 52. Such 

networking environments are commonplace in office netwbrlQS, enterprise-wide computer 
networks, intranets and the Internal, which are all types of networks. 

When used in a LAN-networking environment, the computer 20 is connected to 
10 the local nehrork 5 1 through a network interface or adapter 53, which is one type of 
communications oisvice. When used in a WAN-networking environment, the computer 
20 typically includes a modem 54, a type of communications device, or any other type of 
commimications device for establishing communications over the wide area network 52, 
such as the Internal. The modem 54^^w^ch may be intemal or extemal, is connected to 
1 S^^the system bus 23 via the serial port interface^46. In a networked environment, program 
/ modules depicted relative to the personal computer 20, or portions thereof, may be stored 
in the remote memory storage device. It is appreciated that the network connections 
shown are exemplary and other means of and communications devices for establishing a 
commimications link between the computers may be used. 

20 

Mobile Computing Environment 

In this section of the detailed description, an example mobile computing 
environment in conjunction with which embodiments of the invention can be practiced. 
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That is, an example mobile computing environment, made up of ambients (containers) 
and processes (threads), is presented. Modal logics can then be used to represent these 
ambients and processes, as well as describe configurations of multiple such ambients and 
processes, and policies and formulas against which specific ambients and processes can 
be applied to determine if they satisfy the policies and formulas. That is, model checking 
as described herein can be used in accordance with such modal logics. 

Referring to FIG. 2, an example mobile computing environment 200 is shown. 
The environment 200. specifically includes ambients, or containers, 202, 204 and 206. As 
shown in FIG. 2, the ambient 202 resides within the ambient 204. The ambient 202 is 
named a\ the ambient 204 is named b\ and, the ambient 206 is named c. A process P 
resides within the ambient 204, while a process Q resides within the ambient 202, and 
processes R and S reside within the ambient 206. 

As has been described, each ambient, or container, can be a software or a 
hardware container. A software container may be a particular area defined by an 
operating system. Examples include stacks, heaps, sand boxes, as the latter term is 
referred to in the context of the Java programming language, etc. A hardware container 
may be a particular computer, such as a client or a server computer, as well as a particular 
computer peripheral. An example of a computer has been described in the preceding 
section of the detailed description. 

More specifically, an ambient as used herein has the following properties: 

• Each ambient has a name. The name of an ambient is used to control access 
(entry, exit, commiuiication, etc.). In a realistic situation the true name of an 
ambient would be guarded very closely, and only specific capabilities would be 
handed out about how to use the name. In our examples we are usually more 
liberal in the handling of names, for sake of simplicity. 
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• Each ambient has a collection of local agents (referred interchangeably herein as 
threads or processes). These are the computations that run directly within the 
ambient and, in a sense, control the ambient. For example, they can instruct the 
ambient to move. 

• Each ambient may have a collection of subambients. Each subambient has its own 
name, agents, subambients, etc. 

Names refer to: 

• something that can be created, passed around and used to name new ambients. 

• something from which capabilities can be extracted. 

The logic of embodiments of the invention pertains to a mobile computing 
environment. Thus, the ambients of FIG. 2 are mobile. As shown in FIG. 2, for example, 
the ambient 202 is moving out of the ambient 204. There may be, for example, a 
particular poUcy or formula, expressed in the logic, that defines whether such a move can 
occur, such that it can be applied against the ambient 202 and the policy therein to 
determine whether such a move should be allowed to occur. Each of the ambients and 
their resident processes are also representable in the logic of embodiments of the 
invention, which is described in the next section of the detailed description. 

Modal Logic 

In this section of the detailed description, modal logics based on ambient calculus, 
and providing for spatial relationships among processes of containers are presented. The 
logic makes assertions about the containment and contiguity of containers. Part of the 
logic is concerned with matching the syntactic structure of expressions in the calculus. 
The matching of the structure of formulas to the structure of processes is done in a 
flexible manner, up to a process equivalence, such that it is not entirely syntactical. A 
number of logical inference rules, including rules for propositional logic, rules for modal 
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operators such as time, space and vaUdity, and rules for locations and process 
composition are also derived. 



Basic Ambient Calculus 
5 The following table summarizes a basic ambient calculus upon which a modal 

logic according to an embodiment of the invention is based. There is no name restriction 
in the basic ambient calculus. The subsequent tables summarize the syntax of processes, 
the structural congruence relation between processes, and the reduction semantics. 
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processes 




0 


inactivity 




P\Q 


composition 




IP 


replication 




M[P] 


ambient 


15 


M.P 


capability action 




{nyp 


input action 




{M) 


async output action 




M::= 


messages 


20 


n 


name 




in M 


can enter into M 




out M 


can exit out of M 




open M 


can open M 




e 


null 


25 


MM 


path 



Inactivity for a process means that the process does nothing; that is, it has no 



activity. The composition P \ Q means there is a resulting process composed of both P 
and Q. Replication means that the process has been replicated, or duplicated, as opposed 
30 to moving from one container to another; the replication \P means the same effectively 
as an infinite array of replicas of P running in parallel.. The ambient M [P] means that 
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the process P resides within the container, or ambient, M The capability action 

M.P means that the process is capable of the action, or functionality, M followed by the 

continuation P. The input action {n),P means that the process can accept an input 

message, bind it to n and continue with P. The asynchronous output action (m) means 

that the process performs an output of the message M and stops. 

A message expression M can take one of several forms. It can be a name n. It 
can be one of the capabilities, in M, out M, or open M, whose effect when exercised, 
respectively, is to move the enclosing ambient into a sibling M, to move the enclosing 
ambient out its parent M, or to dissolve the boundary around an adjacent ambient M It 
can be a null capability s. Or it may be a path MM\ whose effect is that of exercising 
first M and then M\ A process P has a set of free names, written as fn(P), which 
generally refers to any of the names textually occurring in the process P can take. More 
formdWy ^fn(P) is defined by the following table. 




(l)/«(0)@^ 

{2)fn{P\Q)@fii{P)yjfii{Q) 
\{y)fn{^.P)@Jh{P) 

(4)/n(M[P])@//j(M)u>(/> 

(6)fn{^nXP^f^P)-{n} 
r^M))@fn{M) 



(S)fn {n) 
(9)fn{inM)@J 

M)@fii{M) 
{U)MopenM)@fii{M) 
{n)fii{e)@l> 

(13)/n {MM ') @Jh (M) u fn {M ') 




The thirteen statements within this table are explained as follows. The first 
statSnMit~stetes_ttiat there are no free names for the inactivity process. The symbol @ 
specifies that the left-hmid sidToftiiel^nbonSTTdefingd^a^^ of the 

symbol. This definition is applicable in any statement in which the symBol-^^ppears. 
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"xThe second statement states that the free names for the composition P\Q are the free 
nanoe^-iiDr P conjoined with the free names for Q. The third statement states that when a 
process is repU^tedJfrom^another process, it has the same free names as that latter 
process. The fourth statement slSte^ttiat the free names of a container M having therein a 
5 process P are the free names of M by itself c^iyomed with the free names of P - that is, 
^ M[P] cannot take on any names that are not allowed by^ittiei:^A/ks or P itself. The 
fifth statement states that the free names of the input action (w).Pare mfe^fi;ee names of 
the process minus the name n. 

The seventh statement states that the free names of the asynchronous output 

10 action (M) are the same as the free names of the message M itself. The eighth statement 

means that the free names of a name n is the singleton set containing n. The ninth 
statement means that the free names of the capability "can enter into M" are the same as 
the free names of M itself. Likewise, the tenth and eleventh statements means that the 
free names of the capabilities "can exit out of M" and "can open M," respectively, are the 

15 same as the free names of M itself. The twelfth statement states that there are no free 
names for the null capability. The last statement states that the free names of the path 
MAf ' are equal to the free names of M conjoined with the free names of M\ 

Furthermore, it is noted that the terminology P{n<-M} is used for the substitution 
of the capability M for each free occurrence of the name n in the process P, and similarly 

20 fox M{n<-M'}, 

Structural congruence is defined as summarized in the following table. We use the 
symbol = to denote the relation of structural congruence, and in general write the phrase 
P^QXo mean that processes P and Q are equal up to structural congruence. 
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ly 



10 



15 



20 



(1)P=P 


(Struct Refl) 




(Struct Symm) 




(Struct Trans) 


{4)P^Q=>P\R^Q\R 


(Struct Par) 


{5)P^Q^\P = \Q 


(Struct Repl) 


(6)p=o=^M\p^=M\o^ 


("Struct Amb'i 




(Struct Action) 


(8)Fse=>(x).P^(x).g 


(Struct Input) 






{10){M.M').P = M.M'.P 


(Struct .) 


in)P\Q^Q\P 


(Struct Par Comm) 


in){P\Q)\R^P\{Q\R) 


(Struct Par Assoc) 


(13)!P = P|!P 


(Struct Repl Par) 


(14)P|0 = P 


(Struct Zero Par) 


(15)!OsO 


(Struct Zero Repl) 



f This table is explained as follows. Structural reflectivity means that P is equal to 

y 25 P. Structural symmetry means that if P equals Q, then Q equals P, Structural 

r\ 

1 transitivity means that if P equals Q and g equals R, then P also equals /?. The fourth 

statement means that if P equals Q, then the composition P | /? is equal to the composition 
Q I R. The fifth statement means that if P equals Q, then the replication of P equals the 
replication of Q. The sixth statement means that if P equals Q the ambient M in which P 
30 is contained, M{P], equals the ambient M in which (3 is contained, M[Q]. Similarly, the 
seventh statement means that if P equals Q, then the exercise of the expression M before 
the action of P, MP, is equal to the exercise of the expression A/ before the action of 2? 



17 



M.Q. The eighth statement means that if P equals Q, then P prefixed by the input action 
X is equal to Q prefixed by the input action x. 

The ninth statement means that prefixing the process P with the null capability is 
the same as just stating the process P. The tenth statement means that stating (M.M').P is 
5 the same as stating M.M'.P. The eleventh statement is the commutative property, that the 
composition P\Q is equal to the composition Q\P. The twelfth statement is the 
associative property, that the composition of {P\Q) and R is equal to the composition of P 
and {Q,\R). The thirteenth statement states that the replication of P is equal to the 
composition P\\P. The fourteenth statement is an identity statement, that the composition 
10 of P and the inactivity process is equal to P, while the fifteenth statement states that 
replicating the inactivity process is equal to the inactivity process itself 

Reduction is summarized in the next table. In it, the left side of the arrow (->) 
reduces to the expression on the right side of the arrow. 
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{\)n[inm.P\Q\\m{R]-^m[n{P\Q]\R] 

(2) m [n[out m.P \Q]\ R]^ n[P \Q]\m [R] 

(3) open n.P\n[Q]-^P\Q 

(4) {n).P\{M)-^P{n'^M} 



(Red In) 
(Red Out) 
(Red Open) 



(Red Comm) 



20 



i5)P-^Q=>n[P]-^n[Q] 
{6jP^Q^P\R--yQ\R 



(Red Amb) 
(Red Par) 



(7) /»• s p,/> -> = => />• ^ g- 



(Reds) 



25 



(8)-^* 



reflexive and transitive closure of -> 



. FinaUy^tiie^^ syntactic conventions and abbreviations, as summarized in 




the next table, are used herein. A fact is also provided. 
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Syntactic conventions 




M.P\Q 



is read 



is read 



is read 



{M.P)\Q 
{(n)-P)\Q 



10 



5 



Fact 



Abbreviations 



M 



n 



[] 




n [P] = m [P'] iff « = /n and P s P" 
Logical Formulas 

In this next sub-section, logical formulas of the modal logic, according to one 
15 embodiment of the invention, are presented. The logical formulas are based on a modal 
predicate logic with classical negation, as can be appreciated by those of ordinary skill 
within the art. Many connectives are interdefinable: existential formulations are given 
preference, because they have a more intuitive meaning than the corresponding universal 
ones. Two tables are provided: one specifying the logical formulas, and the next 
20 specifying connectives derived from the logical formulas. 




B, C :: 




1 
2 
3 
4 
5 
6 
7 
8 
9 
10 




true 
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The logical formulas of the preceding table are described as follows. The first 
stat'^^ient is a logical true, while the second statement is a logical negation and the fourth 
statement i^^ogical disjunction. The fourth statement means that the process A is 
located within the container, or ambient, n. The fifth statement is a logical composition. 
The sixth statement specifies^^e existential quantifier operation, that there is some 
process A within the container namecTh^The seventh statement specifies a spatial 
operator, that somewhere, at some location, tnfe^rocess A exists. That is, within some 
container, anywhere in the domain space being consid^d, the process A exists. 
Similarly, the eighth statement specifies a temporal operator/ti:\at at some point in time, 
the process A will exist (or currently exists). The ninth statement spbdfies that the 
process A exists within the container named n. Finally, the tenth statemenH^a logical 
composition adjunct. 
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2 A A 

3 A => B 

4 A O B 

5 A B 

6 !A 
7?A 

8 V/J.A 

9 MA 

10 DA 

11 A@ 

12 >A 



(-,A V -iB) 

@-iA~~v-^ 
@(A => B)"X^ 
@-,(^A .1 -,B) 
@A F 

@A I T (O -i!-.A) 
@-i3«.-.A 

@-.0-<A 

@^/I.A@Al 

@r>A . 



A) 




false 

conjunction 
implication 
logical equivalence 
decomposition 
every component satisfies A 
me component satisfies A 
xmivfeFsal quantification over names 
everywhCTevmodality (spatial) 
everytime mooMit^temporal) 
in every location conte^ct 
in every composition confexl^ 



The derived connectives of the preceding table are explained as follows. The first 



Statement is the logical false, and is derived and defined as a fimction of the logical 
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le second statement is the logical conjunction, while the third statement is the logical 
implic^on and the fourth logical equivalence. The fifth statement specifies logical 
decompositioit>sThe sixth statement defines !A as universal satisfaction, that every 
component satisfies ^ibs^rocess A. Likewise, the seventh statement defines ? A as 
partial satisfaction, that some'^coinponent satisfies the process A. The eighth statement 
defines the universal quantifier V ^^la;is^the existential quantifier 3; that all the 
processes A are within the container «. The ninth statement states that the process A 
exists everywhere, firom a spatial perspective, while^tf^e tenth statement states that the 
process A has existed, and still exists, at every time. Theb^yenth and twelfth statements 
specify the in every location context and the in every composition^ntext, respectively, 
and are derived firom the eleventh and twelfth logical formula statementsbf^he logical 
formulas table. 

Finally, the following syntactic conventions are utilized herein. 

• Parentheses are used for explicit precedence. 

. / •__Iafixi> ^nds slxongei than '|', and ihey botn bmd stronger thair flie sldiidaid 
^ logical connectives. 

• Standard precedence is used for the standard logical connectives. 

• Quantifiers and modalities extend to the right as much as possible. 

Satisfaction 

The satisfaction relation P A (process P satisfies formula A) is defined 



inductively in the following tables, where n is the soil of pxt^eesses^^^O^ the sort of 
formulas, and A is the sort of names. Quantification and sorting of meta- variables are 
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made explicit because of subtle scoping issues, particularly in the definition of P 3w.A. 
SimTlar syntax foFlogical connectives is used at the meta-level and object-level. 

The meaning of the temporal modality is given by reductions in the operational 
semantics of the ambient calculus. For the spatial modality, the following definitions are 
5 needed. The relation PiP' indicates that P contains P* within exactly one level of nesting. 
Then, Pi^P' is the reflexive and transitive closure of the previous relation, indicating that 
P contains P' at some nesting level. Note that P' constitutes the entire contents of an 
enclosed ambient. 

1 0 PiP' iff 3n, P'\P = nfP'J I P" 

>l * is the reflexive and transitive closxire of i 



VP:n. 


P T 








P -.A 




-.PA 




P AvB 




P A vP B 


VP:n,/i:A, A:0. 






3P':n.P = «[P] aP' a 


Vi':n,A,B:<E>. 


p aT^b^ 




3P'^":n.PsP1P"A P' AaP" B 


VP:n, n:A, A:0. 


P 3n.A 




-.^"J^A.. P A 


VP:n, A:<D 


P <-A 




3??ir:P4.*^P' A 


VP:n, A:<D 


P OA 




3P':n. P-^*P^A:Pi>J^ 


V/>:n, A:0 


P K@n 




n[P] A ^"^""---^ 


VP:n, A,B:<I>. 


P A>B 




VP':n.P' A=>P|P' B 



logical connectives of the preceding table are read as follows: 

• Any process satisfies the T formula. 

• A process satisfies the -lA formula if it does not satisfy the A formula. 

• A process satisfies the AvB formula if it satisfies either the A or the B formula. 

• A process P s atisfies th e n\TK \ fnn riMlf^ if there OTiiritn a procpr^n P' nurh thnt P ~ 
andP' A^ 

• A pr ocessP^satis fie s the A ' | A" formu 4a4f-t bprfi ffvigt pm rp ^ssf^s P' and P" ffiirh 
tEaTP^Pn^" with P' satisfying A ' and P" satisfying A" . 
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A process P satisfies the formula 3w.A if there is a name m such that P satisfies 
K{n<r-m]. (N.B.: the meta-theoretical definition above precisely captiuiestiie fact 
that m can be instantiated to, but cannot itself clash with any name free in P) ^ 

A process P satisfies the formula ^ A if A holds at some location P ' within P, 
where "sublocation" is defined by Pi* P \ 

A process P satisfies the formula OA if A holds in the future for some residuaL P ' 
of P, where "residual" is defined by P * P 




A process P satisfies the formula A@n if, when placed in an ambient «, the 
combination n[P] satisfies A. 

A process P satisfies the formula A >B if, given any parallel context P ' satisfying 
ATEhrcoffibinatiiMiPJ,^^ B. Another reading of P A >B is that P 
manages to satisfy B underanyposSibte-attacl^^ that is boimd to 

satisfy A. Moreover, " P satisfies (dA) >(dA)" means 
invariant A. 



VP:n. 

n. A, B:0, 

VP:riS^^ <I>. 
VP:n, A, B^ 
VP:n,A, B:0. 
VP:n, A:(D. 
VP:n, A: (D. 
/J/VP:n,n:A, A: <D. 
[ ^ VP:n, A: <D. 
VP:n, A:0. 
VP:n, A:<D. 
VP:n, A:<D. 
VP:n, A, B:<D. 

The derived logical connectives of the preceding table are read as follows: 
No process satisfies the F formula. 

A proceSs-s^tisfies the A aB formula if it satisfies both the A and the B formula. 

A process satisfies ffi&A-^B formula if either it does not satisfy the A formula or 
it satisfies the B formula 



-,P F 




P AaB 


iffP A aP B 


P A=>B 


iflfP A => P B 


P A<»B 


iffP A <» P B 


?»-A B 


iffyFJ*":U.P = F\P"=> F A V P" B 


P ! A\^^ 


iff VP-^-in. P = F\P" => P' A 


P 7h ^ 


--^aP-^'^n. P = F\P" A P* A 


P Vn.A 


SrVw; A. P A{n<^m} 


P HA 


iff^P':Tt>P^F => F A 


P DA 


i{{\/P'.n.P^'^P^^^ A 


P A@ 


iffV/i: A. P A@n 


P >A 


ifrVP':n.P|P A 


P >{A=>B) 


iffVP':n.P|P A => P-IP B T^^^^B) 





A process satisfies the A <=>B formula if il 
formulas. 



sfies neither or both the A and B 
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A process P satisfies the !A formula if every parallel component F of P (such 
that P = F\F\ including F = 0) satisfies the A formula. 

process P satisfies the ?A formula if there is a parallel component P' of P (such 
;P = F|P") that satisfies the A formula. 

A procfes^ P satisfies the formula Vw.A if for every name w, P satisfies A{n< 
m). 

A process P satisfies the formula A if A holds at every location F v^ithin P, 
where "sublocation" is defined by P>l*P. 

A process P satisfies the formula dA if A holds in the future for every residual F 
of P, where "residual" is^efined by P-^*P. 

A process P satisfies the fonm^la A @ if, when placed in any ambient n, the 
combination n[P] satisfies A. 

A process P satisfies the formul a >ASf for every process (i.e., for every context) 
^ ttie-coTllbiiStibn of P and with that process satisfies A. 

• -I^OTocess P satisfies the formula A>B5 it me^te^tfiat in every context that satisfies 

/ A , thp^^rnnHwatinri (nf P and thp rnntevt) sati^sfip^ Tn5;tfi?^(1„ if prnrpsR P 

, V satisfies the formula >(A^B), it means that in every cciptext, if the combinatior 
/ satisfies A then the combination satisfies B, 

20 The following proposition states that the satisfaction relation is^l^yariant under 

structural congruence. 

t\ ■ P^P'=>{P -fr^rPnq 

A list of examples of the satisfaction relations is now provided. These examples 

25 should appear intuitively true fi-om the definitions. 

Location 

n[T] 

«[]>0 n[T], because n[]\0 = n[] 
n[m[him[T]] 
30 ^0 n[T] 

■"«[] ffi[T],ifW/« 




1 



r 



Composition 

«[] I m[] n[T] I m[T] 
35 n[] \ m[] m[T] | n[T], becails^ n[] | m[] = m[] \ n[] 

«[] I P «[T] I T 

n[] n[T] I T, because n[] = n[]\0 
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10 



15 



20 



L 



.1- 



30 



^n[] n[T] I T, because !«[] ^ n[] \ \n[] 
n[T] I n[T] 
.41 I n[] n[T] 
-n!«[l«[T] 

I open m n[T] 

Quantification 

n[] 3/n.m[T\iff 3p.n[] p[T] iff «[] w[T] iff true 
n[m[]] 3nM[nl%]] iff Bp. n[m[]] p[p[T]] iff false 
0 Vn. -n«[T] 



Spatial Modality 

^m[T] 
- I /«[]] ^m[T] 

Temporal Modality 

I ope/i n Om[T] 
n[n[]] I c?pe« n □(n[T] | T) 

Location Adjtmct 

n[] m[n[Tmm 
n[outm] (Ort[T])@m 

Composition Adjunct 

n[] m[T]>(n[T] | m[T]) 
open n. m[] (□«[T])>(Ow[T]) 

Presence 

ann = n[T] \ T 
no n = -nan n 
one n = /i[T] | wo « 
unique n = «[n«o«]| 
!(n[T]^«[A]) 
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(there isViow an n here) 

(there is now no n here) 

(there is now exactly one n here) 

(there is now exactly one n, and it is here) 

(every n here\atisfies A) 



Validity and Satisfiability 

It is noted that a formula is valid if it is satisfied by every process, and is 
satisfiable if it is satisfied by some process. This is sxmmiarized in the following table. 



vldA 



~ VP:n. P A 



sat A 



= 3P:n. P A 



A is vahd 
"Trtrsattsfiable- 



25 



From these definitions, the following are obtained: 
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vWA=^ sat A 
vWAo -nsat^h 
vW(AaB) vldA AvWB 
vW(AvB) <^ vWA V vldB 

Validity is used for modeling logical inference rules, as described in the next 
definition. A linearized notation is used for inference rules, where the usual horizontal 
bar separating antecedencts firom consequents is written V\ and V is used to separate 
antecedents. 

Definition (Sequents and Rules) 
JSequents: 

--ft — B — ^==viajR =>~B) ' 





Ai Bi;.7:-^A«B„ / A B = 

Ai Bi A_AA;r-^=>A B (n>0) 
Ai B1//A2 B2 = 

Ai B1/A2 B2 AA2 B2/A1 
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Inference Rules 



In this section, logical inference rules firom the satisfaction relation are derived. 

The following is a non-standard presentation of the sequent calculus, where each 
sequentKa&'ej^actlyone assumption and one conclusion: A B. This presentation is 
30 adopted because the logical connecBveSTntrQduced later do not preserve the shape of 



|j multiple- assimiption multiple-conclusion sequents. MoreoV^^o^^ presentation the 



rules of propositional logic become extremely symmetrical. Prepositional logic is 
simimarized in the following table. 



r 



iAiX — ftA(eAf)) — &"//-fA- AC) AD — B • 
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A (CvD) vB // A Cv(DvB) 
AaC B / CaA B 
CvB / A BvC 
Aa^VB / A B 
(C-R) A Bvfe\/ A B 
(W-L) A B / A>G B 
(W-R) A B / A 
(Id) / A A 

(Cut) A CvB; A' AC e\/ AaA' BvB' 
(T) AaT B / a B 
(F) A FvB / A B 
(-1-L) A CvB / Aa-hC B 
(-I-R) AaC B / A -.CvB 
(a) a B; A' B' / AaA' BaB' 
(v) A B; A' B' / AvA' BvB ' 

The standard deduction rules of propositional logic, both for the sequent calculus 

and for natural deduction, are derivable from the rules of the preceding table, as can be 

appreciated by those of ordinary skill within the art. As usual, A B can be defined as 



5 -,AvB. 

For predicate logic the syntax of formulas (but not of processes) is enriched with 
variables ranging over names. These variables are indicated by letters x, y, z. Quantifiers 
^ bind variables, not names. Then, if_^^(Sll^tc7rrrT7WCfeLare the free variables of A and 

(pe/v(A) ->A is a substitution of variables for names, A<p for A {x\^f^(x\), x^^-^^ 
1 0 is written, and the following is defined: 
vWA = VP:n.PA<p 

The following table summarizes quantifiers over names. 
(V-L) A {x<-m}B/Vx AB 



,<riV:R)— A- 
1\ (3-L) A B/3x A.B 

(3-R) A B {x<r-m) I A 3a;.B 




Where jc g/KA) 
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This leads to the following o, 0, and M , properties: 



(1) vW(d(Aa B)<:*d a ad B) 

(2) vW(h(Aa B)oH AaH B) 

(3) vW(d(A V B)o □ a vd B) 

(4) vW(H(A V B)<» H A vH B) 



In the following table, it is propositioned that 0, and h , are modal S4: 



0 



(0) 

(□4) 
(□M) 

(□A) 
(□V) 
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20 



25 
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/T OA <=> -.D-iA 

IT □(A=> B)=>(nADB) 

.aA=> A 
IT UK 
A B / OA DB 
□(AaC) B // dAadC B 
A □(CvB)//A nCvoB 



(HK) 
(HT) 
(H4) 

(Ma) 

(M V) 




IT HA O 

IT M(A=> 

IT HA=> 

IT HA=> 

Hi 

H(AaC) B 

A H(CvB)//A HCvHB 



-.H-.A 

B)=>(HA 

A 

H HA 
HB 



HB) 



It is noted, that because 



nVWOA : 
nVW HA 



□OA 
H<^A 



the modalities are not S5. 

lally, location properties, location rules, composition properties, and 
compositionSrules are listed. 



Location Propel 

(1) vW(«[AaB] 

(2) vW(«[AvB] 



«[A] A /j[B]) 
v/i[A] V /j[B]) 




Location Rules 

(/![]) A BZ/^A] /j[B] 

(/j[]a) /j[AaC] \//«[A]An[C] B 

(«[]a) a n[CvB]\A «[C]v«[B] 

Composition Properties 

(1) vW(A|B=J> B|A) 

(2) vW(A|(B|C)o (A|B)|C) 

(3) vW((AaB)|C=> A|CaB|C) 

(4) vW((AvB)|C=> A|Cv B | C) 
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Composition Rules 
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(I) 

(|A) 

(|v) 

(in) 

(I-) 
(l-E) 



10 



A' B';A" B"/A'|A" B'|B" 
|C D/A|CaB|C D 
A (Bvt^ivl^A B I D V C I D 
/ A' I A" A B-^ts:: A' I B" V B' | A" 
/ -i(A' I A") A -.(B-i^^^CB' I A") V (-.A' I -,B") 
A B' I B"; A'a(B' I C") DTaIWC | B") D 

/ (aa(a'aa"))a(c' n 




Adjunctions 

le following propositions and corollaries relate to location adjunct rules, and 
15 composition adjunct rules. The first proposition states that A@n and n[A] are adjuncts. 

Proposition: Dpcation Adjunct Rules 
(«[]@) \ "[A] B//A B@« 

Corollaries 
20 (1) vldn[A@n]=^A 
3^(2) vWA=> n[A]@n 

Proposition: Composition Adjunct Rules 
(|>) A|C b\/A OB 

Corollaries 

(1) vldA >B|B=> B 

(2) vldA=> B>(AB) 
30 (3) vWA>B|B>C=> A>C 

Reflecting Validity 

In this sub-section, validity and satisfiability are reflects 




35 of the > operator 



Sat A 



= (^A)>F 
= -.(A>F) 
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Fropi this validity and satisfiability, two propositions and one lemma are 
described: 



10 



Proposition: nd and Sat 

(1) vldVldA<^vldh 

(2) vldSat Aci>\atA 

Lemma: Vld, Sat PBoperties 



(1) vld{Vld{AAB) 

(2) vW(FZJ(AvB) 



VldA A VldB) 
VldAw VldB) 



Proposition: Vld, Sat iAModal S5 



(Sat) 
(VldK) 
(VldT) 
(Vld 5) 
20 (VldM) 
(VldA) 
(Vldv) 



IT SatTi^ ^Vld-,A 
I T f7i/(A=^> B) ^ {{VldA) => {Vldh)) 
IT (W</A)U A 
IT {SatA) X{Vld Sat A) 
A B / VldA WldB 
Vld{AAC) B iKvldA a VldC B 
A Vld{CvB)ll\ VldCw VldB 



25 Reflecting Name Equality 

Finally, it is noted that it is possible to encode name equality within the logic in 
terms of validity. It is recalled that ann = /i[T] | T. One proposition then follows. 



30^^^^ ^ = >? - JdcK^amr^ an n) 
^j^ Proposition 
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vldm = n <=> the names m and « are equal 
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Examples 

In this section of the detailed description, examples of mobile computing 
environments in conjunction with the modal logic of the preceding section are presented. 
SpecificaUyTTouF^eparate^situ^i^ are shown in the diagram of FIG. 6, and an 
additional situation is shown in the diagram ofFlGr^r^JJiose of ordinary skill within the 
art can appreciate that the situations of FIGs. 6 and 7 are examples forlHttstrgtive^^^^^ 
purposes only, and do not represent a limitation on the invention. 

Referring first to FIG. 6, four situations are presented, situations 600, 602, 604 
and 60o\hi situation 600, a container n includes a process Q, and includes a policy 
10 telling the contamer how to behave. Specifically, the policy is in m.P^ which instructs the 
container n includingHhe process Q to move into the container m already having the 
policy R therein, as shown m^ituation 600. In situation 602, a container n includes a 



r 



process Q, and the policy telling tnfescontainer how to behave is out m.P, which instructs 



U the container n including the process Q to move out of the container m also having the 
1 5 policy R therein, as shown. In situation 604, the pdHqy or instruction open n,P is 

executed on the container n having the process such tha^ig^xits the container « as a 
result. Finally, in situation 606, a replicated instruction is executed^ the process P, 
such that an additional process P is made (that is, process P is copied). 

Referring next to FIG. 7, a communication operation referred to as a note is 
20 shoAvn in the situation 700. The note can reside within a contginerrTfiecapabilities that 
can be held by the note include names^,.suehrSsw, as well as action capabilities, such as in 
n, out /I, open nj^^i^st-p^fi^such as C.C, as has been described in the modal logic section 
oftHe detailed description. 
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Methods 

In this section of the detailed description, computer-implemented methods 
according to varying embodiments of the invention are presented. The methods make use 

5 of the modal logics described in the previous section of the detailed description, which 
are based on ambient calculus and provide for spatial relationships among processes of 
containers. The methods relate to a model-checking algorithm. The computer- 
implemented methods are desirably reaUzed at least in part as one or more programs 
running on a computer ~ that is, as a program executed from a computer- or machine- 

1 0 readable medium such as a memory by a processor of a computer. The programs are 
desirably storable on a machine-readable medium such as a floppy disk or a CD-ROM, 
for distribution and installation and execution on another computer. 

As described herein, the method references sub-methods norm, sublocation and 
reachable. In one embodiment of the invention, these sub-methods are implemented as 

1 5 described in a succeeding embodiment of the invention. 

Referring now to FIG. 3, a flowchart of a method according to an embodiment of 
the invention is shown. In 300, a process is input. This is the process that is to be 
analyzed. The process may be a thread, an applet, an agent, etc.; the invention is not so 
limited. The process itself may be a composition of one or more processes. For example, 

20 the process can be the composition P\Q\Ry where each of P, Q and is a separate 
process. Again, the invention is not so limited. 

302, ^^V^^i '^in ^19 , anH ^1/1 implpmpnt thff nnfilyr . ir . of thp prnnpo s 

against a formula, using a predetermined modal logic based on ambient calculus, 
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according to one embodiment of the invention. The foraiula against which the process is 
to be analyzed can be a policy, such as a security policy or a mobiHty poUcy, such that 
the policy^is^i^scribed using the predetermined modal logic, such as has been described 
in the preceding sections 'dfthodetailed description. In one embodiment, the process is 



5 analyzed in a recursive manner. The analySis^Qf 302, 304, 306, 308, 310, 312 and 314 
can be summarized as a theorem, specifically, /ar all resiHetign-free process P and >- 
free closed formulas A, P A if and only if Check(P,A), where ^Check^^ of 
302, 304, 306, 308, 310, 312 and 314, 

In 302 specifically, the process is analyzed in three ways, referred herein as an 
10 initial checking of the process against the formula. First, it is checked that 

Check(P,T) = T . This means that if the formula is T then the outcome of the analysis is 
T for any process. Second, it is checked that Check(P,-iA ) = -nCheck(P,A ) . This 
means that if the formula is a negation -lA then the outcome of the analysis is the 
negation of a recursive analysis of the process P against formula A . . Third, it is checked 
15 that Check(P,A vb ) = Check(P^A ) v Check(Pj3 ) . This means that the outcome of the 
analysis is the disjunction of recursively checking the process P against formula A and 
checking the process Q against formula B • 

In 304 specifically, the process is normalized, and it is determined whether the 
process includes only one element, or entry. If there is more than one element, then the 
20 process fails against the policy. The check of 304 only applies if the formula is a location 
«[A]. This check can be expressed as: 



Check {P,n[A ]) = 



Check{Q,A ) if Norm{P) = [n[Q]] for someQ 
F otherwise 
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In 306 specifically, the process is partitioned to determine whether each 



">rrmpA ngjit nf tVip pmresR satisfies the formula, o r policy. If any component fails against 

^ — 

the policy, then the process itself fails. The check of 306 only applies if the formulais 
composition A ' B. This check can be expressed as: 

Check{P,A |b ) = let[;ri,...,;rj = A^orm(P)in 

T if 3/, J./Uy = L.A:a/I J = (ffA 

Check[Yli^i^i^^ )^Check([lj^j^j.^ ) 
F otherwise 




^process. If this verification fails, then the 



In 308 specifically, all of the names of the process are determined. Then, it is 
verified that a name exists for the formula that is unequal to any of the nasies-ertne 

ails against the policy. The 
check of 308 only apglie&4ftEe formula is an existential quantification 3jc. A. This check 
1 0 can^e5^essed as : 

CheckiP, 3JC.A ) = let {m, ,,,,,m^} = fn (P) U > (a ) in 



/w, , . .., } be some firesh name in 
T if Check (pXIT^^^^^ 
F otherwise 



In one embodiment, a unification algorithm, as known within the art, can be used to 
effectuate the check of 308, to make the check more efficient. However, the invention is 
not so limited. 

15 In 3 10 specifically, each sub location of the process is checked, or analyzed, 

against the formula, or process. If the check fails for any sub location, then the process 
itself fails against the policy. The check of 310 only applies if the formula is a 
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somewhere modality ^A. This check can be expressed as: 

Check{P,<-A ) = let[/^, ...,/>] = SubLocations (P)in 

(T if C/iecA:(/^,A )forsomez€l../: . 
F otherwise 

In 312 specifically, the spatial reach of the processed is checked, or analyzed, 
against the formula, or process. This check thus determines whether the process has a 
finite spatial reach. If the check fails, then the process itself fails against the policy. The 
check of 312 only appUes if the formula is a sometime modality OA. This check can be 
expressed as: 

Check (P„ A ) = let [/;,..., = Reachable (P) in 

Jt \iCheck{P^,A )forsomez€l..A:. 
[F otherwise 

In 314 specifically, it is checked recursively that the process satisfies a formula 
when enclosed in a surrounding ambient. If the check fails, then the process itself fails 
against the policy. The check of 314 only applies if the formula is a location adjxmct 

A@« . This can be expressed as Check (P, a @ « ) = Check (« [P] , a ) . 

Finally, in 3 1 6, whether or not the process satisfied the formula - based on the 
analysis conducted in 302, 304, 306, 308, 310 and 312, is output. The invention is not 
limited to the manner by which output is accomplished. For example, in one 
embodiment, it can be output to a fiirther analysis program or software component, that 
allows for analysis and conclusions to be drawn. As another example, the output can be 
displayed on a display device, or printed to a printer, etc. As a third example, output can 
mean storage to a storage device, for later and/or fiirther analysis by a program or 
software component. 
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As can be appreciated by those of ordinary skill within the art, the above method 
can be effectuated by a system in one embodiment of the invention. That is, a system 
including a processor and a computer-readable medium, such that first data stored on the 
medium represents the process, and second data stored on the medium represents the 
formula. In such an instance, an analysis program is executed by the processor from the 
mediimi to analyze the process against the formula, for example, in a recursive manner. 

Sub-Methods 

In this section of the detailed description, the sub-methods norm, reachable, and 
sublocations, as referenced in the previous section of the detailed description, are 
described, according to one embodiment of the invention. However, the invention is not 
so limited to the embodiment of this section. 

First, the sub-method norm is described. Any replication-free process may be 
factored up to stmctural congruence into a normal form consisting of a composition of 
prime processes, where a prime process is an ambient, an action, an input, or an output. 

In the following table, the prime processes are first defined. The normal form is 
stated in terms of the following notation: for processes /J , let the notation 

Y\i^i jfc ^ short for the composition | ... t 1 0- 
Prime processes, and normal forms: 

;r ::= Prime process 




Ambient 



Action 

Input 

Ouput 



{x).P 

{M) 
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Y\ , ^ Replication-free normal form 

Next, an algorithm is defined for computing normal forms. Given a process, the 
following function returns a list of primes, which represents a normal form of the process. 
The notation [;r, /r^^ ] is used for a list of primes. List concatenation is written as 
follows: [;rp...,;^J + 4-[;rp...,;r;] = [;rp...,;rjt,;7';,...,;r,']. Then the notation P€[i^,...,Pj 
is used as a shorthand for P g {/^ , } . 

Computing a normal form of a replication-free process: 

Norm{M[P])==[M[P]'] 
Norm{0) = [ ] 

Norm {P\Q) = Norm (P) + -hNorm (Q) 

Norm {M.P) = Norm (P) if Head (M) =g 

Norm {M.P) = [M, . (M^.P)] if Head {M)^M, 

A^or/w((x).P) = [(jc).P] 

A^or/w((M)) = [{M)] 

Since all the recursive calls are on subprocesses of the original process, the algorithm 
always terminates. Moreover, if Norm{P) = \7t^,.,..,n^thenP ^ Wi^x k^r 

Next, the sub-method sublocations is described. An algorithmic characterization 
of the pV P' predicate is used, which is used in the definition of the spatial modality. 
Specifically, we define a procedure SubLocations{P) for computing representatives of all 
processes P' such that PV P\ The definition of SubLocations{P) depends on a 
subroutine Children{P), which computes representatives of all processes P' such that 
PiP', 
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Computing the children of a normal form is as follows: 
Children {[ ]) = [] 



Children {P'.:Ps) = 



Q :: Children (Ps) ifP = n [Q] 
Children (Ps) otherwise 



The following lemma and proposition are then given as: 
Lemma Suppose Children , ]) = [/^ , /J ] . 

(1) Foralliel..k,Y[.^^^7rjiP,. 

(2) IfYl .^^ ,^jiQ then Q = P.for some iel..k. 
Proposition Suppose Children {Norm (P)) = [/{ ] . 

{\) For alii &\..k,PiPi. 

(2) If Pi Qthen Q = Pi for some i el..k. 

Computing the sublocations of a process is then given as: 

SubLocations (P) = let [/»,..., = Children (Norm (P)) in 

[P] + ^SubLocations (/}) + +... + +SubLocations (i^ ) 

The following lemma is needed, however. Note that it cannot be generalized to 

the reflexive case, that is, where I* is substituted for 4'* . 

Lemma IfP' = P,Pi* Q, and Q = Q', then P' >^* Q'. 

A proposition is next given as, ^ 

Proposition Suppose SubLocations (P) = [i^ , P^ ] . 

(1) Forallie\..k,Pi' 

(2) IfPi'Q then Q = P, for somei e \..k. 
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Finally, the sub-method reachable is described. Computing the sublocations of a 
process gives: 

Reachable (P) = let [P, , ] = Next (P) in 

[P] + -^Reachable (/;) + +... + ^Reachable (P^ ) 

There is one lemma and one proposition associated with this, 

Lemma IfF = P,P^^ Q, and Q = Q\ then P' Q\ 

Proposition Suppose Reachable (P) = [i^ , ] . 

(1) Foralli€l.,k,P'^* P,. 

(2) IfP V QthenQ = P^ forsomei g 1..A:. 

Conclusion 

Although specific embodiments have been illustrated and described herein, it will 
be appreciated by those of ordinary skill in the art that any arrangement which is 
calculated to achieve the same purpose may be substituted for the specific embodiments 
shown. This application is intended to cover any adaptations or variations of the present- 
invention. Therefore, it is manifestly intended that this invention be limited only by the 
following claims and equivalents thereof 
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